diff options
| author | BALATON Zoltan <balaton@eik.bme.hu> | 2020-06-20 22:56:28 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2020-06-30 22:46:28 +0200 |
| commit | f018edc358669d42553f4a636b7611d05ab2198f (patch) | |
| tree | fc130ef56d130dae73fe84b6ca881ab26c0a9404 | |
| parent | ba27110fab0b7ba26ff6a36a7311481181dd83f8 (diff) | |
| download | focaccia-qemu-f018edc358669d42553f4a636b7611d05ab2198f.tar.gz focaccia-qemu-f018edc358669d42553f4a636b7611d05ab2198f.zip | |
sm501: Do not allow guest to set invalid format
Prevent guest setting invalid format value that might trip checks in sm501_2d_operation(). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 26d4fa9b8ce81e2723e98d592ccba7550042752c.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | hw/display/sm501.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/display/sm501.c b/hw/display/sm501.c index 6349f31e64..7e4c042d52 100644 --- a/hw/display/sm501.c +++ b/hw/display/sm501.c @@ -1503,6 +1503,9 @@ static void sm501_2d_engine_write(void *opaque, hwaddr addr, s->twoD_background = value; break; case SM501_2D_STRETCH: + if (((value >> 20) & 3) == 3) { + value &= ~BIT(20); + } s->twoD_stretch = value; break; case SM501_2D_COLOR_COMPARE: |